Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* |
1da177e4 LT |
2 | * Common NFSv4 ACL handling code. |
3 | * | |
4 | * Copyright (c) 2002, 2003 The Regents of the University of Michigan. | |
5 | * All rights reserved. | |
6 | * | |
7 | * Marius Aamodt Eriksen <marius@umich.edu> | |
8 | * Jeff Sedlak <jsedlak@umich.edu> | |
9 | * J. Bruce Fields <bfields@umich.edu> | |
10 | * | |
11 | * Redistribution and use in source and binary forms, with or without | |
12 | * modification, are permitted provided that the following conditions | |
13 | * are met: | |
14 | * | |
15 | * 1. Redistributions of source code must retain the above copyright | |
16 | * notice, this list of conditions and the following disclaimer. | |
17 | * 2. Redistributions in binary form must reproduce the above copyright | |
18 | * notice, this list of conditions and the following disclaimer in the | |
19 | * documentation and/or other materials provided with the distribution. | |
20 | * 3. Neither the name of the University nor the names of its | |
21 | * contributors may be used to endorse or promote products derived | |
22 | * from this software without specific prior written permission. | |
23 | * | |
24 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED | |
25 | * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF | |
26 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | |
27 | * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE | |
28 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR | |
29 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | |
30 | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR | |
31 | * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF | |
32 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING | |
33 | * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS | |
34 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
35 | */ | |
36 | ||
5a0e3ad6 | 37 | #include <linux/slab.h> |
1da177e4 | 38 | #include <linux/nfs_fs.h> |
4ac7249e | 39 | #include "nfsfh.h" |
3554116d | 40 | #include "nfsd.h" |
2ca72e17 | 41 | #include "acl.h" |
4ac7249e | 42 | #include "vfs.h" |
1da177e4 | 43 | |
4ac7249e CH |
44 | #define NFS4_ACL_TYPE_DEFAULT 0x01 |
45 | #define NFS4_ACL_DIR 0x02 | |
46 | #define NFS4_ACL_OWNER 0x04 | |
1da177e4 LT |
47 | |
48 | /* mode bit translations: */ | |
49 | #define NFS4_READ_MODE (NFS4_ACE_READ_DATA) | |
50 | #define NFS4_WRITE_MODE (NFS4_ACE_WRITE_DATA | NFS4_ACE_APPEND_DATA) | |
51 | #define NFS4_EXECUTE_MODE NFS4_ACE_EXECUTE | |
52 | #define NFS4_ANYONE_MODE (NFS4_ACE_READ_ATTRIBUTES | NFS4_ACE_READ_ACL | NFS4_ACE_SYNCHRONIZE) | |
53 | #define NFS4_OWNER_MODE (NFS4_ACE_WRITE_ATTRIBUTES | NFS4_ACE_WRITE_ACL) | |
54 | ||
55 | /* We don't support these bits; insist they be neither allowed nor denied */ | |
56 | #define NFS4_MASK_UNSUPP (NFS4_ACE_DELETE | NFS4_ACE_WRITE_OWNER \ | |
57 | | NFS4_ACE_READ_NAMED_ATTRS | NFS4_ACE_WRITE_NAMED_ATTRS) | |
58 | ||
59 | /* flags used to simulate posix default ACLs */ | |
60 | #define NFS4_INHERITANCE_FLAGS (NFS4_ACE_FILE_INHERIT_ACE \ | |
7bdfa68c | 61 | | NFS4_ACE_DIRECTORY_INHERIT_ACE) |
1da177e4 | 62 | |
7bdfa68c BF |
63 | #define NFS4_SUPPORTED_FLAGS (NFS4_INHERITANCE_FLAGS \ |
64 | | NFS4_ACE_INHERIT_ONLY_ACE \ | |
65 | | NFS4_ACE_IDENTIFIER_GROUP) | |
b548edc2 | 66 | |
1da177e4 LT |
67 | #define MASK_EQUAL(mask1, mask2) \ |
68 | ( ((mask1) & NFS4_ACE_MASK_ALL) == ((mask2) & NFS4_ACE_MASK_ALL) ) | |
69 | ||
70 | static u32 | |
71 | mask_from_posix(unsigned short perm, unsigned int flags) | |
72 | { | |
73 | int mask = NFS4_ANYONE_MODE; | |
74 | ||
75 | if (flags & NFS4_ACL_OWNER) | |
76 | mask |= NFS4_OWNER_MODE; | |
77 | if (perm & ACL_READ) | |
78 | mask |= NFS4_READ_MODE; | |
79 | if (perm & ACL_WRITE) | |
80 | mask |= NFS4_WRITE_MODE; | |
81 | if ((perm & ACL_WRITE) && (flags & NFS4_ACL_DIR)) | |
82 | mask |= NFS4_ACE_DELETE_CHILD; | |
83 | if (perm & ACL_EXECUTE) | |
84 | mask |= NFS4_EXECUTE_MODE; | |
85 | return mask; | |
86 | } | |
87 | ||
88 | static u32 | |
bec50c47 | 89 | deny_mask_from_posix(unsigned short perm, u32 flags) |
1da177e4 | 90 | { |
bec50c47 BF |
91 | u32 mask = 0; |
92 | ||
93 | if (perm & ACL_READ) | |
94 | mask |= NFS4_READ_MODE; | |
95 | if (perm & ACL_WRITE) | |
96 | mask |= NFS4_WRITE_MODE; | |
97 | if ((perm & ACL_WRITE) && (flags & NFS4_ACL_DIR)) | |
98 | mask |= NFS4_ACE_DELETE_CHILD; | |
99 | if (perm & ACL_EXECUTE) | |
100 | mask |= NFS4_EXECUTE_MODE; | |
101 | return mask; | |
1da177e4 LT |
102 | } |
103 | ||
104 | /* XXX: modify functions to return NFS errors; they're only ever | |
105 | * used by nfs code, after all.... */ | |
106 | ||
09229edb BF |
107 | /* We only map from NFSv4 to POSIX ACLs when setting ACLs, when we err on the |
108 | * side of being more restrictive, so the mode bit mapping below is | |
109 | * pessimistic. An optimistic version would be needed to handle DENY's, | |
110 | * but we espect to coalesce all ALLOWs and DENYs before mapping to mode | |
111 | * bits. */ | |
112 | ||
113 | static void | |
114 | low_mode_from_nfs4(u32 perm, unsigned short *mode, unsigned int flags) | |
1da177e4 | 115 | { |
09229edb | 116 | u32 write_mode = NFS4_WRITE_MODE; |
1da177e4 | 117 | |
09229edb BF |
118 | if (flags & NFS4_ACL_DIR) |
119 | write_mode |= NFS4_ACE_DELETE_CHILD; | |
1da177e4 LT |
120 | *mode = 0; |
121 | if ((perm & NFS4_READ_MODE) == NFS4_READ_MODE) | |
122 | *mode |= ACL_READ; | |
09229edb | 123 | if ((perm & write_mode) == write_mode) |
1da177e4 LT |
124 | *mode |= ACL_WRITE; |
125 | if ((perm & NFS4_EXECUTE_MODE) == NFS4_EXECUTE_MODE) | |
126 | *mode |= ACL_EXECUTE; | |
1da177e4 LT |
127 | } |
128 | ||
129 | struct ace_container { | |
130 | struct nfs4_ace *ace; | |
131 | struct list_head ace_l; | |
132 | }; | |
133 | ||
134 | static short ace2type(struct nfs4_ace *); | |
28e05dd8 BF |
135 | static void _posix_to_nfsv4_one(struct posix_acl *, struct nfs4_acl *, |
136 | unsigned int); | |
1da177e4 | 137 | |
4ac7249e CH |
138 | int |
139 | nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry, | |
140 | struct nfs4_acl **acl) | |
1da177e4 | 141 | { |
4ac7249e CH |
142 | struct inode *inode = dentry->d_inode; |
143 | int error = 0; | |
144 | struct posix_acl *pacl = NULL, *dpacl = NULL; | |
145 | unsigned int flags = 0; | |
28e05dd8 | 146 | int size = 0; |
1da177e4 | 147 | |
4ac7249e | 148 | pacl = get_acl(inode, ACL_TYPE_ACCESS); |
35e634b8 | 149 | if (!pacl) |
4ac7249e | 150 | pacl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL); |
35e634b8 KM |
151 | |
152 | if (IS_ERR(pacl)) | |
153 | return PTR_ERR(pacl); | |
154 | ||
09bdc2d7 BF |
155 | /* allocate for worst case: one (deny, allow) pair each: */ |
156 | size += 2 * pacl->a_count; | |
4ac7249e CH |
157 | |
158 | if (S_ISDIR(inode->i_mode)) { | |
159 | flags = NFS4_ACL_DIR; | |
160 | dpacl = get_acl(inode, ACL_TYPE_DEFAULT); | |
35e634b8 KM |
161 | if (IS_ERR(dpacl)) { |
162 | error = PTR_ERR(dpacl); | |
163 | goto rel_pacl; | |
164 | } | |
165 | ||
4ac7249e CH |
166 | if (dpacl) |
167 | size += 2 * dpacl->a_count; | |
1da177e4 LT |
168 | } |
169 | ||
bcaab953 | 170 | *acl = kmalloc(nfs4_acl_bytes(size), GFP_KERNEL); |
4ac7249e CH |
171 | if (*acl == NULL) { |
172 | error = -ENOMEM; | |
173 | goto out; | |
174 | } | |
bcaab953 | 175 | (*acl)->naces = 0; |
1da177e4 | 176 | |
09bdc2d7 | 177 | _posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT); |
1da177e4 | 178 | |
28e05dd8 | 179 | if (dpacl) |
4ac7249e | 180 | _posix_to_nfsv4_one(dpacl, *acl, flags | NFS4_ACL_TYPE_DEFAULT); |
1da177e4 | 181 | |
35e634b8 | 182 | out: |
4ac7249e | 183 | posix_acl_release(dpacl); |
35e634b8 KM |
184 | rel_pacl: |
185 | posix_acl_release(pacl); | |
4ac7249e | 186 | return error; |
1da177e4 LT |
187 | } |
188 | ||
bec50c47 BF |
189 | struct posix_acl_summary { |
190 | unsigned short owner; | |
191 | unsigned short users; | |
192 | unsigned short group; | |
193 | unsigned short groups; | |
194 | unsigned short other; | |
195 | unsigned short mask; | |
196 | }; | |
197 | ||
28e05dd8 | 198 | static void |
bec50c47 | 199 | summarize_posix_acl(struct posix_acl *acl, struct posix_acl_summary *pas) |
1da177e4 | 200 | { |
bec50c47 | 201 | struct posix_acl_entry *pa, *pe; |
f7fede4b BF |
202 | |
203 | /* | |
204 | * Only pas.users and pas.groups need initialization; previous | |
205 | * posix_acl_valid() calls ensure that the other fields will be | |
206 | * initialized in the following loop. But, just to placate gcc: | |
207 | */ | |
208 | memset(pas, 0, sizeof(*pas)); | |
bec50c47 BF |
209 | pas->mask = 07; |
210 | ||
211 | pe = acl->a_entries + acl->a_count; | |
212 | ||
213 | FOREACH_ACL_ENTRY(pa, acl, pe) { | |
214 | switch (pa->e_tag) { | |
215 | case ACL_USER_OBJ: | |
216 | pas->owner = pa->e_perm; | |
217 | break; | |
218 | case ACL_GROUP_OBJ: | |
219 | pas->group = pa->e_perm; | |
220 | break; | |
221 | case ACL_USER: | |
222 | pas->users |= pa->e_perm; | |
223 | break; | |
224 | case ACL_GROUP: | |
225 | pas->groups |= pa->e_perm; | |
226 | break; | |
227 | case ACL_OTHER: | |
228 | pas->other = pa->e_perm; | |
229 | break; | |
230 | case ACL_MASK: | |
231 | pas->mask = pa->e_perm; | |
232 | break; | |
233 | } | |
234 | } | |
235 | /* We'll only care about effective permissions: */ | |
236 | pas->users &= pas->mask; | |
237 | pas->group &= pas->mask; | |
238 | pas->groups &= pas->mask; | |
1da177e4 LT |
239 | } |
240 | ||
241 | /* We assume the acl has been verified with posix_acl_valid. */ | |
28e05dd8 | 242 | static void |
1da177e4 LT |
243 | _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl, |
244 | unsigned int flags) | |
245 | { | |
bec50c47 BF |
246 | struct posix_acl_entry *pa, *group_owner_entry; |
247 | struct nfs4_ace *ace; | |
248 | struct posix_acl_summary pas; | |
249 | unsigned short deny; | |
1da177e4 | 250 | int eflag = ((flags & NFS4_ACL_TYPE_DEFAULT) ? |
54c04409 | 251 | NFS4_INHERITANCE_FLAGS | NFS4_ACE_INHERIT_ONLY_ACE : 0); |
1da177e4 LT |
252 | |
253 | BUG_ON(pacl->a_count < 3); | |
bec50c47 | 254 | summarize_posix_acl(pacl, &pas); |
1da177e4 LT |
255 | |
256 | pa = pacl->a_entries; | |
bec50c47 BF |
257 | ace = acl->aces + acl->naces; |
258 | ||
259 | /* We could deny everything not granted by the owner: */ | |
260 | deny = ~pas.owner; | |
261 | /* | |
262 | * but it is equivalent (and simpler) to deny only what is not | |
263 | * granted by later entries: | |
264 | */ | |
265 | deny &= pas.users | pas.group | pas.groups | pas.other; | |
266 | if (deny) { | |
267 | ace->type = NFS4_ACE_ACCESS_DENIED_ACE_TYPE; | |
268 | ace->flag = eflag; | |
269 | ace->access_mask = deny_mask_from_posix(deny, flags); | |
270 | ace->whotype = NFS4_ACL_WHO_OWNER; | |
271 | ace++; | |
272 | acl->naces++; | |
273 | } | |
274 | ||
275 | ace->type = NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE; | |
276 | ace->flag = eflag; | |
277 | ace->access_mask = mask_from_posix(pa->e_perm, flags | NFS4_ACL_OWNER); | |
278 | ace->whotype = NFS4_ACL_WHO_OWNER; | |
279 | ace++; | |
280 | acl->naces++; | |
1da177e4 LT |
281 | pa++; |
282 | ||
283 | while (pa->e_tag == ACL_USER) { | |
bec50c47 BF |
284 | deny = ~(pa->e_perm & pas.mask); |
285 | deny &= pas.groups | pas.group | pas.other; | |
286 | if (deny) { | |
287 | ace->type = NFS4_ACE_ACCESS_DENIED_ACE_TYPE; | |
288 | ace->flag = eflag; | |
289 | ace->access_mask = deny_mask_from_posix(deny, flags); | |
290 | ace->whotype = NFS4_ACL_WHO_NAMED; | |
ab8e4aee | 291 | ace->who_uid = pa->e_uid; |
bec50c47 BF |
292 | ace++; |
293 | acl->naces++; | |
294 | } | |
295 | ace->type = NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE; | |
296 | ace->flag = eflag; | |
297 | ace->access_mask = mask_from_posix(pa->e_perm & pas.mask, | |
298 | flags); | |
299 | ace->whotype = NFS4_ACL_WHO_NAMED; | |
ab8e4aee | 300 | ace->who_uid = pa->e_uid; |
bec50c47 BF |
301 | ace++; |
302 | acl->naces++; | |
1da177e4 LT |
303 | pa++; |
304 | } | |
305 | ||
306 | /* In the case of groups, we apply allow ACEs first, then deny ACEs, | |
307 | * since a user can be in more than one group. */ | |
308 | ||
309 | /* allow ACEs */ | |
310 | ||
1da177e4 | 311 | group_owner_entry = pa; |
bec50c47 BF |
312 | |
313 | ace->type = NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE; | |
314 | ace->flag = eflag; | |
315 | ace->access_mask = mask_from_posix(pas.group, flags); | |
316 | ace->whotype = NFS4_ACL_WHO_GROUP; | |
317 | ace++; | |
318 | acl->naces++; | |
1da177e4 LT |
319 | pa++; |
320 | ||
321 | while (pa->e_tag == ACL_GROUP) { | |
bec50c47 BF |
322 | ace->type = NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE; |
323 | ace->flag = eflag | NFS4_ACE_IDENTIFIER_GROUP; | |
324 | ace->access_mask = mask_from_posix(pa->e_perm & pas.mask, | |
325 | flags); | |
326 | ace->whotype = NFS4_ACL_WHO_NAMED; | |
ab8e4aee | 327 | ace->who_gid = pa->e_gid; |
bec50c47 BF |
328 | ace++; |
329 | acl->naces++; | |
1da177e4 LT |
330 | pa++; |
331 | } | |
332 | ||
333 | /* deny ACEs */ | |
334 | ||
335 | pa = group_owner_entry; | |
bec50c47 BF |
336 | |
337 | deny = ~pas.group & pas.other; | |
338 | if (deny) { | |
339 | ace->type = NFS4_ACE_ACCESS_DENIED_ACE_TYPE; | |
d8d0b85b | 340 | ace->flag = eflag; |
bec50c47 BF |
341 | ace->access_mask = deny_mask_from_posix(deny, flags); |
342 | ace->whotype = NFS4_ACL_WHO_GROUP; | |
343 | ace++; | |
344 | acl->naces++; | |
345 | } | |
1da177e4 | 346 | pa++; |
bec50c47 | 347 | |
1da177e4 | 348 | while (pa->e_tag == ACL_GROUP) { |
bec50c47 BF |
349 | deny = ~(pa->e_perm & pas.mask); |
350 | deny &= pas.other; | |
351 | if (deny) { | |
352 | ace->type = NFS4_ACE_ACCESS_DENIED_ACE_TYPE; | |
353 | ace->flag = eflag | NFS4_ACE_IDENTIFIER_GROUP; | |
55bb55dc | 354 | ace->access_mask = deny_mask_from_posix(deny, flags); |
bec50c47 | 355 | ace->whotype = NFS4_ACL_WHO_NAMED; |
ab8e4aee | 356 | ace->who_gid = pa->e_gid; |
bec50c47 BF |
357 | ace++; |
358 | acl->naces++; | |
359 | } | |
1da177e4 LT |
360 | pa++; |
361 | } | |
362 | ||
363 | if (pa->e_tag == ACL_MASK) | |
364 | pa++; | |
bec50c47 BF |
365 | ace->type = NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE; |
366 | ace->flag = eflag; | |
367 | ace->access_mask = mask_from_posix(pa->e_perm, flags); | |
368 | ace->whotype = NFS4_ACL_WHO_EVERYONE; | |
369 | acl->naces++; | |
1da177e4 LT |
370 | } |
371 | ||
ab8e4aee EB |
372 | static bool |
373 | pace_gt(struct posix_acl_entry *pace1, struct posix_acl_entry *pace2) | |
374 | { | |
375 | if (pace1->e_tag != pace2->e_tag) | |
376 | return pace1->e_tag > pace2->e_tag; | |
377 | if (pace1->e_tag == ACL_USER) | |
378 | return uid_gt(pace1->e_uid, pace2->e_uid); | |
379 | if (pace1->e_tag == ACL_GROUP) | |
380 | return gid_gt(pace1->e_gid, pace2->e_gid); | |
381 | return false; | |
382 | } | |
383 | ||
1da177e4 LT |
384 | static void |
385 | sort_pacl_range(struct posix_acl *pacl, int start, int end) { | |
386 | int sorted = 0, i; | |
387 | struct posix_acl_entry tmp; | |
388 | ||
389 | /* We just do a bubble sort; easy to do in place, and we're not | |
390 | * expecting acl's to be long enough to justify anything more. */ | |
391 | while (!sorted) { | |
392 | sorted = 1; | |
393 | for (i = start; i < end; i++) { | |
ab8e4aee EB |
394 | if (pace_gt(&pacl->a_entries[i], |
395 | &pacl->a_entries[i+1])) { | |
1da177e4 LT |
396 | sorted = 0; |
397 | tmp = pacl->a_entries[i]; | |
398 | pacl->a_entries[i] = pacl->a_entries[i+1]; | |
399 | pacl->a_entries[i+1] = tmp; | |
400 | } | |
401 | } | |
402 | } | |
403 | } | |
404 | ||
405 | static void | |
406 | sort_pacl(struct posix_acl *pacl) | |
407 | { | |
408 | /* posix_acl_valid requires that users and groups be in order | |
409 | * by uid/gid. */ | |
410 | int i, j; | |
411 | ||
aa07c713 KM |
412 | /* no users or groups */ |
413 | if (!pacl || pacl->a_count <= 4) | |
414 | return; | |
415 | ||
1da177e4 LT |
416 | i = 1; |
417 | while (pacl->a_entries[i].e_tag == ACL_USER) | |
418 | i++; | |
419 | sort_pacl_range(pacl, 1, i-1); | |
420 | ||
421 | BUG_ON(pacl->a_entries[i].e_tag != ACL_GROUP_OBJ); | |
aba24d71 | 422 | j = ++i; |
1da177e4 LT |
423 | while (pacl->a_entries[j].e_tag == ACL_GROUP) |
424 | j++; | |
425 | sort_pacl_range(pacl, i, j-1); | |
426 | return; | |
427 | } | |
428 | ||
09229edb BF |
429 | /* |
430 | * While processing the NFSv4 ACE, this maintains bitmasks representing | |
431 | * which permission bits have been allowed and which denied to a given | |
432 | * entity: */ | |
433 | struct posix_ace_state { | |
434 | u32 allow; | |
435 | u32 deny; | |
436 | }; | |
437 | ||
438 | struct posix_user_ace_state { | |
ab8e4aee EB |
439 | union { |
440 | kuid_t uid; | |
441 | kgid_t gid; | |
442 | }; | |
09229edb BF |
443 | struct posix_ace_state perms; |
444 | }; | |
445 | ||
446 | struct posix_ace_state_array { | |
447 | int n; | |
448 | struct posix_user_ace_state aces[]; | |
449 | }; | |
450 | ||
451 | /* | |
452 | * While processing the NFSv4 ACE, this maintains the partial permissions | |
453 | * calculated so far: */ | |
454 | ||
455 | struct posix_acl_state { | |
3160a711 | 456 | int empty; |
09229edb BF |
457 | struct posix_ace_state owner; |
458 | struct posix_ace_state group; | |
459 | struct posix_ace_state other; | |
460 | struct posix_ace_state everyone; | |
461 | struct posix_ace_state mask; /* Deny unused in this case */ | |
462 | struct posix_ace_state_array *users; | |
463 | struct posix_ace_state_array *groups; | |
464 | }; | |
465 | ||
1da177e4 | 466 | static int |
09229edb | 467 | init_state(struct posix_acl_state *state, int cnt) |
1da177e4 | 468 | { |
09229edb BF |
469 | int alloc; |
470 | ||
471 | memset(state, 0, sizeof(struct posix_acl_state)); | |
3160a711 | 472 | state->empty = 1; |
09229edb BF |
473 | /* |
474 | * In the worst case, each individual acl could be for a distinct | |
475 | * named user or group, but we don't no which, so we allocate | |
476 | * enough space for either: | |
477 | */ | |
478 | alloc = sizeof(struct posix_ace_state_array) | |
91b80969 | 479 | + cnt*sizeof(struct posix_user_ace_state); |
09229edb BF |
480 | state->users = kzalloc(alloc, GFP_KERNEL); |
481 | if (!state->users) | |
482 | return -ENOMEM; | |
483 | state->groups = kzalloc(alloc, GFP_KERNEL); | |
484 | if (!state->groups) { | |
485 | kfree(state->users); | |
486 | return -ENOMEM; | |
487 | } | |
488 | return 0; | |
1da177e4 LT |
489 | } |
490 | ||
09229edb BF |
491 | static void |
492 | free_state(struct posix_acl_state *state) { | |
493 | kfree(state->users); | |
494 | kfree(state->groups); | |
1da177e4 LT |
495 | } |
496 | ||
09229edb | 497 | static inline void add_to_mask(struct posix_acl_state *state, struct posix_ace_state *astate) |
1da177e4 | 498 | { |
09229edb | 499 | state->mask.allow |= astate->allow; |
1da177e4 LT |
500 | } |
501 | ||
09229edb BF |
502 | /* |
503 | * Certain bits (SYNCHRONIZE, DELETE, WRITE_OWNER, READ/WRITE_NAMED_ATTRS, | |
504 | * READ_ATTRIBUTES, READ_ACL) are currently unenforceable and don't translate | |
505 | * to traditional read/write/execute permissions. | |
506 | * | |
507 | * It's problematic to reject acls that use certain mode bits, because it | |
508 | * places the burden on users to learn the rules about which bits one | |
509 | * particular server sets, without giving the user a lot of help--we return an | |
510 | * error that could mean any number of different things. To make matters | |
511 | * worse, the problematic bits might be introduced by some application that's | |
512 | * automatically mapping from some other acl model. | |
513 | * | |
514 | * So wherever possible we accept anything, possibly erring on the side of | |
515 | * denying more permissions than necessary. | |
516 | * | |
517 | * However we do reject *explicit* DENY's of a few bits representing | |
518 | * permissions we could never deny: | |
519 | */ | |
1da177e4 | 520 | |
09229edb BF |
521 | static inline int check_deny(u32 mask, int isowner) |
522 | { | |
523 | if (mask & (NFS4_ACE_READ_ATTRIBUTES | NFS4_ACE_READ_ACL)) | |
524 | return -EINVAL; | |
525 | if (!isowner) | |
526 | return 0; | |
527 | if (mask & (NFS4_ACE_WRITE_ATTRIBUTES | NFS4_ACE_WRITE_ACL)) | |
528 | return -EINVAL; | |
529 | return 0; | |
1da177e4 LT |
530 | } |
531 | ||
09229edb BF |
532 | static struct posix_acl * |
533 | posix_state_to_acl(struct posix_acl_state *state, unsigned int flags) | |
1da177e4 | 534 | { |
09229edb BF |
535 | struct posix_acl_entry *pace; |
536 | struct posix_acl *pacl; | |
537 | int nace; | |
538 | int i, error = 0; | |
1da177e4 | 539 | |
3160a711 BF |
540 | /* |
541 | * ACLs with no ACEs are treated differently in the inheritable | |
aa07c713 KM |
542 | * and effective cases: when there are no inheritable ACEs, |
543 | * calls ->set_acl with a NULL ACL structure. | |
3160a711 | 544 | */ |
aa07c713 KM |
545 | if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) |
546 | return NULL; | |
547 | ||
3160a711 BF |
548 | /* |
549 | * When there are no effective ACEs, the following will end | |
550 | * up setting a 3-element effective posix ACL with all | |
551 | * permissions zero. | |
552 | */ | |
06f9cc12 BF |
553 | if (!state->users->n && !state->groups->n) |
554 | nace = 3; | |
555 | else /* Note we also include a MASK ACE in this case: */ | |
556 | nace = 4 + state->users->n + state->groups->n; | |
09229edb BF |
557 | pacl = posix_acl_alloc(nace, GFP_KERNEL); |
558 | if (!pacl) | |
559 | return ERR_PTR(-ENOMEM); | |
1da177e4 | 560 | |
09229edb BF |
561 | pace = pacl->a_entries; |
562 | pace->e_tag = ACL_USER_OBJ; | |
563 | error = check_deny(state->owner.deny, 1); | |
564 | if (error) | |
565 | goto out_err; | |
566 | low_mode_from_nfs4(state->owner.allow, &pace->e_perm, flags); | |
09229edb BF |
567 | |
568 | for (i=0; i < state->users->n; i++) { | |
569 | pace++; | |
570 | pace->e_tag = ACL_USER; | |
571 | error = check_deny(state->users->aces[i].perms.deny, 0); | |
572 | if (error) | |
573 | goto out_err; | |
574 | low_mode_from_nfs4(state->users->aces[i].perms.allow, | |
575 | &pace->e_perm, flags); | |
ab8e4aee | 576 | pace->e_uid = state->users->aces[i].uid; |
09229edb | 577 | add_to_mask(state, &state->users->aces[i].perms); |
1da177e4 LT |
578 | } |
579 | ||
09229edb BF |
580 | pace++; |
581 | pace->e_tag = ACL_GROUP_OBJ; | |
582 | error = check_deny(state->group.deny, 0); | |
583 | if (error) | |
584 | goto out_err; | |
585 | low_mode_from_nfs4(state->group.allow, &pace->e_perm, flags); | |
09229edb BF |
586 | add_to_mask(state, &state->group); |
587 | ||
588 | for (i=0; i < state->groups->n; i++) { | |
589 | pace++; | |
590 | pace->e_tag = ACL_GROUP; | |
591 | error = check_deny(state->groups->aces[i].perms.deny, 0); | |
592 | if (error) | |
593 | goto out_err; | |
594 | low_mode_from_nfs4(state->groups->aces[i].perms.allow, | |
595 | &pace->e_perm, flags); | |
ab8e4aee | 596 | pace->e_gid = state->groups->aces[i].gid; |
09229edb BF |
597 | add_to_mask(state, &state->groups->aces[i].perms); |
598 | } | |
1da177e4 | 599 | |
5513a510 | 600 | if (state->users->n || state->groups->n) { |
06f9cc12 BF |
601 | pace++; |
602 | pace->e_tag = ACL_MASK; | |
603 | low_mode_from_nfs4(state->mask.allow, &pace->e_perm, flags); | |
604 | } | |
1da177e4 | 605 | |
09229edb BF |
606 | pace++; |
607 | pace->e_tag = ACL_OTHER; | |
608 | error = check_deny(state->other.deny, 0); | |
609 | if (error) | |
610 | goto out_err; | |
611 | low_mode_from_nfs4(state->other.allow, &pace->e_perm, flags); | |
1da177e4 | 612 | |
09229edb BF |
613 | return pacl; |
614 | out_err: | |
615 | posix_acl_release(pacl); | |
616 | return ERR_PTR(error); | |
617 | } | |
1da177e4 | 618 | |
09229edb BF |
619 | static inline void allow_bits(struct posix_ace_state *astate, u32 mask) |
620 | { | |
621 | /* Allow all bits in the mask not already denied: */ | |
622 | astate->allow |= mask & ~astate->deny; | |
623 | } | |
1da177e4 | 624 | |
09229edb BF |
625 | static inline void deny_bits(struct posix_ace_state *astate, u32 mask) |
626 | { | |
627 | /* Deny all bits in the mask not already allowed: */ | |
628 | astate->deny |= mask & ~astate->allow; | |
629 | } | |
1da177e4 | 630 | |
ab8e4aee | 631 | static int find_uid(struct posix_acl_state *state, kuid_t uid) |
09229edb | 632 | { |
ab8e4aee | 633 | struct posix_ace_state_array *a = state->users; |
09229edb | 634 | int i; |
1da177e4 | 635 | |
09229edb | 636 | for (i = 0; i < a->n; i++) |
ab8e4aee | 637 | if (uid_eq(a->aces[i].uid, uid)) |
09229edb BF |
638 | return i; |
639 | /* Not found: */ | |
640 | a->n++; | |
641 | a->aces[i].uid = uid; | |
642 | a->aces[i].perms.allow = state->everyone.allow; | |
643 | a->aces[i].perms.deny = state->everyone.deny; | |
1da177e4 | 644 | |
09229edb | 645 | return i; |
1da177e4 LT |
646 | } |
647 | ||
ab8e4aee EB |
648 | static int find_gid(struct posix_acl_state *state, kgid_t gid) |
649 | { | |
650 | struct posix_ace_state_array *a = state->groups; | |
651 | int i; | |
652 | ||
653 | for (i = 0; i < a->n; i++) | |
654 | if (gid_eq(a->aces[i].gid, gid)) | |
655 | return i; | |
656 | /* Not found: */ | |
657 | a->n++; | |
658 | a->aces[i].gid = gid; | |
659 | a->aces[i].perms.allow = state->everyone.allow; | |
660 | a->aces[i].perms.deny = state->everyone.deny; | |
661 | ||
662 | return i; | |
663 | } | |
664 | ||
09229edb | 665 | static void deny_bits_array(struct posix_ace_state_array *a, u32 mask) |
1da177e4 | 666 | { |
09229edb | 667 | int i; |
1da177e4 | 668 | |
09229edb BF |
669 | for (i=0; i < a->n; i++) |
670 | deny_bits(&a->aces[i].perms, mask); | |
1da177e4 LT |
671 | } |
672 | ||
09229edb | 673 | static void allow_bits_array(struct posix_ace_state_array *a, u32 mask) |
1da177e4 | 674 | { |
09229edb | 675 | int i; |
1da177e4 | 676 | |
09229edb BF |
677 | for (i=0; i < a->n; i++) |
678 | allow_bits(&a->aces[i].perms, mask); | |
1da177e4 LT |
679 | } |
680 | ||
09229edb BF |
681 | static void process_one_v4_ace(struct posix_acl_state *state, |
682 | struct nfs4_ace *ace) | |
1da177e4 | 683 | { |
09229edb BF |
684 | u32 mask = ace->access_mask; |
685 | int i; | |
686 | ||
3160a711 BF |
687 | state->empty = 0; |
688 | ||
09229edb BF |
689 | switch (ace2type(ace)) { |
690 | case ACL_USER_OBJ: | |
691 | if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) { | |
692 | allow_bits(&state->owner, mask); | |
693 | } else { | |
694 | deny_bits(&state->owner, mask); | |
695 | } | |
696 | break; | |
697 | case ACL_USER: | |
ab8e4aee | 698 | i = find_uid(state, ace->who_uid); |
09229edb BF |
699 | if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) { |
700 | allow_bits(&state->users->aces[i].perms, mask); | |
701 | } else { | |
702 | deny_bits(&state->users->aces[i].perms, mask); | |
703 | mask = state->users->aces[i].perms.deny; | |
704 | deny_bits(&state->owner, mask); | |
705 | } | |
706 | break; | |
707 | case ACL_GROUP_OBJ: | |
708 | if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) { | |
709 | allow_bits(&state->group, mask); | |
710 | } else { | |
711 | deny_bits(&state->group, mask); | |
712 | mask = state->group.deny; | |
713 | deny_bits(&state->owner, mask); | |
714 | deny_bits(&state->everyone, mask); | |
715 | deny_bits_array(state->users, mask); | |
716 | deny_bits_array(state->groups, mask); | |
717 | } | |
718 | break; | |
719 | case ACL_GROUP: | |
ab8e4aee | 720 | i = find_gid(state, ace->who_gid); |
09229edb BF |
721 | if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) { |
722 | allow_bits(&state->groups->aces[i].perms, mask); | |
723 | } else { | |
724 | deny_bits(&state->groups->aces[i].perms, mask); | |
725 | mask = state->groups->aces[i].perms.deny; | |
726 | deny_bits(&state->owner, mask); | |
727 | deny_bits(&state->group, mask); | |
728 | deny_bits(&state->everyone, mask); | |
729 | deny_bits_array(state->users, mask); | |
730 | deny_bits_array(state->groups, mask); | |
731 | } | |
732 | break; | |
733 | case ACL_OTHER: | |
734 | if (ace->type == NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE) { | |
735 | allow_bits(&state->owner, mask); | |
736 | allow_bits(&state->group, mask); | |
737 | allow_bits(&state->other, mask); | |
738 | allow_bits(&state->everyone, mask); | |
739 | allow_bits_array(state->users, mask); | |
740 | allow_bits_array(state->groups, mask); | |
741 | } else { | |
742 | deny_bits(&state->owner, mask); | |
743 | deny_bits(&state->group, mask); | |
744 | deny_bits(&state->other, mask); | |
745 | deny_bits(&state->everyone, mask); | |
746 | deny_bits_array(state->users, mask); | |
747 | deny_bits_array(state->groups, mask); | |
748 | } | |
1da177e4 LT |
749 | } |
750 | } | |
751 | ||
4ac7249e CH |
752 | static int nfs4_acl_nfsv4_to_posix(struct nfs4_acl *acl, |
753 | struct posix_acl **pacl, struct posix_acl **dpacl, | |
754 | unsigned int flags) | |
1da177e4 | 755 | { |
575a6290 | 756 | struct posix_acl_state effective_acl_state, default_acl_state; |
09229edb BF |
757 | struct nfs4_ace *ace; |
758 | int ret; | |
1da177e4 | 759 | |
575a6290 | 760 | ret = init_state(&effective_acl_state, acl->naces); |
09229edb | 761 | if (ret) |
575a6290 BF |
762 | return ret; |
763 | ret = init_state(&default_acl_state, acl->naces); | |
764 | if (ret) | |
765 | goto out_estate; | |
766 | ret = -EINVAL; | |
28e05dd8 | 767 | for (ace = acl->aces; ace < acl->aces + acl->naces; ace++) { |
09229edb BF |
768 | if (ace->type != NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE && |
769 | ace->type != NFS4_ACE_ACCESS_DENIED_ACE_TYPE) | |
575a6290 | 770 | goto out_dstate; |
b548edc2 | 771 | if (ace->flag & ~NFS4_SUPPORTED_FLAGS) |
575a6290 | 772 | goto out_dstate; |
7bdfa68c | 773 | if ((ace->flag & NFS4_INHERITANCE_FLAGS) == 0) { |
575a6290 | 774 | process_one_v4_ace(&effective_acl_state, ace); |
b548edc2 | 775 | continue; |
7bdfa68c | 776 | } |
575a6290 BF |
777 | if (!(flags & NFS4_ACL_DIR)) |
778 | goto out_dstate; | |
7bdfa68c BF |
779 | /* |
780 | * Note that when only one of FILE_INHERIT or DIRECTORY_INHERIT | |
781 | * is set, we're effectively turning on the other. That's OK, | |
782 | * according to rfc 3530. | |
783 | */ | |
575a6290 BF |
784 | process_one_v4_ace(&default_acl_state, ace); |
785 | ||
786 | if (!(ace->flag & NFS4_ACE_INHERIT_ONLY_ACE)) | |
787 | process_one_v4_ace(&effective_acl_state, ace); | |
1da177e4 | 788 | } |
575a6290 BF |
789 | *pacl = posix_state_to_acl(&effective_acl_state, flags); |
790 | if (IS_ERR(*pacl)) { | |
791 | ret = PTR_ERR(*pacl); | |
4b2ca38a | 792 | *pacl = NULL; |
575a6290 BF |
793 | goto out_dstate; |
794 | } | |
3160a711 BF |
795 | *dpacl = posix_state_to_acl(&default_acl_state, |
796 | flags | NFS4_ACL_TYPE_DEFAULT); | |
575a6290 BF |
797 | if (IS_ERR(*dpacl)) { |
798 | ret = PTR_ERR(*dpacl); | |
4b2ca38a | 799 | *dpacl = NULL; |
575a6290 | 800 | posix_acl_release(*pacl); |
4b2ca38a | 801 | *pacl = NULL; |
575a6290 BF |
802 | goto out_dstate; |
803 | } | |
804 | sort_pacl(*pacl); | |
805 | sort_pacl(*dpacl); | |
806 | ret = 0; | |
807 | out_dstate: | |
808 | free_state(&default_acl_state); | |
809 | out_estate: | |
810 | free_state(&effective_acl_state); | |
811 | return ret; | |
1da177e4 LT |
812 | } |
813 | ||
4ac7249e CH |
814 | __be32 |
815 | nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, | |
816 | struct nfs4_acl *acl) | |
817 | { | |
818 | __be32 error; | |
819 | int host_error; | |
820 | struct dentry *dentry; | |
821 | struct inode *inode; | |
822 | struct posix_acl *pacl = NULL, *dpacl = NULL; | |
823 | unsigned int flags = 0; | |
824 | ||
825 | /* Get inode */ | |
826 | error = fh_verify(rqstp, fhp, 0, NFSD_MAY_SATTR); | |
827 | if (error) | |
828 | return error; | |
829 | ||
830 | dentry = fhp->fh_dentry; | |
831 | inode = dentry->d_inode; | |
832 | ||
833 | if (!inode->i_op->set_acl || !IS_POSIXACL(inode)) | |
834 | return nfserr_attrnotsupp; | |
835 | ||
836 | if (S_ISDIR(inode->i_mode)) | |
837 | flags = NFS4_ACL_DIR; | |
838 | ||
839 | host_error = nfs4_acl_nfsv4_to_posix(acl, &pacl, &dpacl, flags); | |
840 | if (host_error == -EINVAL) | |
841 | return nfserr_attrnotsupp; | |
842 | if (host_error < 0) | |
843 | goto out_nfserr; | |
844 | ||
845 | host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS); | |
846 | if (host_error < 0) | |
847 | goto out_release; | |
848 | ||
849 | if (S_ISDIR(inode->i_mode)) { | |
850 | host_error = inode->i_op->set_acl(inode, dpacl, | |
851 | ACL_TYPE_DEFAULT); | |
852 | } | |
853 | ||
854 | out_release: | |
855 | posix_acl_release(pacl); | |
856 | posix_acl_release(dpacl); | |
857 | out_nfserr: | |
858 | if (host_error == -EOPNOTSUPP) | |
859 | return nfserr_attrnotsupp; | |
860 | else | |
861 | return nfserrno(host_error); | |
862 | } | |
863 | ||
864 | ||
1da177e4 LT |
865 | static short |
866 | ace2type(struct nfs4_ace *ace) | |
867 | { | |
868 | switch (ace->whotype) { | |
869 | case NFS4_ACL_WHO_NAMED: | |
870 | return (ace->flag & NFS4_ACE_IDENTIFIER_GROUP ? | |
871 | ACL_GROUP : ACL_USER); | |
872 | case NFS4_ACL_WHO_OWNER: | |
873 | return ACL_USER_OBJ; | |
874 | case NFS4_ACL_WHO_GROUP: | |
875 | return ACL_GROUP_OBJ; | |
876 | case NFS4_ACL_WHO_EVERYONE: | |
877 | return ACL_OTHER; | |
878 | } | |
879 | BUG(); | |
880 | return -1; | |
881 | } | |
882 | ||
bcaab953 BF |
883 | /* |
884 | * return the size of the struct nfs4_acl required to represent an acl | |
885 | * with @entries entries. | |
886 | */ | |
887 | int nfs4_acl_bytes(int entries) | |
1da177e4 | 888 | { |
bcaab953 | 889 | return sizeof(struct nfs4_acl) + entries * sizeof(struct nfs4_ace); |
1da177e4 LT |
890 | } |
891 | ||
1da177e4 LT |
892 | static struct { |
893 | char *string; | |
894 | int stringlen; | |
895 | int type; | |
896 | } s2t_map[] = { | |
897 | { | |
898 | .string = "OWNER@", | |
899 | .stringlen = sizeof("OWNER@") - 1, | |
900 | .type = NFS4_ACL_WHO_OWNER, | |
901 | }, | |
902 | { | |
903 | .string = "GROUP@", | |
904 | .stringlen = sizeof("GROUP@") - 1, | |
905 | .type = NFS4_ACL_WHO_GROUP, | |
906 | }, | |
907 | { | |
908 | .string = "EVERYONE@", | |
909 | .stringlen = sizeof("EVERYONE@") - 1, | |
910 | .type = NFS4_ACL_WHO_EVERYONE, | |
911 | }, | |
912 | }; | |
913 | ||
914 | int | |
915 | nfs4_acl_get_whotype(char *p, u32 len) | |
916 | { | |
917 | int i; | |
918 | ||
e8c96f8c | 919 | for (i = 0; i < ARRAY_SIZE(s2t_map); i++) { |
1da177e4 LT |
920 | if (s2t_map[i].stringlen == len && |
921 | 0 == memcmp(s2t_map[i].string, p, len)) | |
922 | return s2t_map[i].type; | |
923 | } | |
924 | return NFS4_ACL_WHO_NAMED; | |
925 | } | |
926 | ||
ddd1ea56 | 927 | __be32 nfs4_acl_write_who(struct xdr_stream *xdr, int who) |
1da177e4 | 928 | { |
ddd1ea56 | 929 | __be32 *p; |
1da177e4 LT |
930 | int i; |
931 | ||
e8c96f8c | 932 | for (i = 0; i < ARRAY_SIZE(s2t_map); i++) { |
3554116d BF |
933 | if (s2t_map[i].type != who) |
934 | continue; | |
ddd1ea56 BF |
935 | p = xdr_reserve_space(xdr, s2t_map[i].stringlen + 4); |
936 | if (!p) | |
3554116d | 937 | return nfserr_resource; |
ddd1ea56 | 938 | p = xdr_encode_opaque(p, s2t_map[i].string, |
3554116d | 939 | s2t_map[i].stringlen); |
3554116d | 940 | return 0; |
1da177e4 | 941 | } |
3554116d | 942 | WARN_ON_ONCE(1); |
f7ce5d28 | 943 | return nfserr_serverfault; |
1da177e4 | 944 | } |